@avi770/testteam 2.0.0 → 3.2.0

package/dist/bridge/sentinel-reader.js

@@ -0,0 +1,88 @@
+/**
+ * Sentinel posture reader (dashboard S3 — The Sentinel).
+ *
+ * The Security Audit layer (agent #8, core/security-audit) is a LIBRARY: a full
+ * active scan needs a live {@link ScanTarget} (prod/staging URLs, dependency
+ * manifest, IaC blobs) the bridge does not have. So — mirroring the S2
+ * knowledge-map reader — this derives a REAL security posture from data the
+ * bridge DOES have: the latest pipeline run's persisted findings from the
+ * engine "security" squad (agents 07, 34, 35, 36, 37, 38 — the agents the
+ * Sentinel composes), fed through the Sentinel's own PURE scoring functions
+ * (buildAttackPaths → computePostureScore → rankFindings).
+ *
+ * Decision D-UI-6: posture is run-derived, not a live active/deep scan. EPSS +
+ * CVE reachability + data-sensitivity blast-radius weighting require an active
+ * scan (the CLI path), so at read-time EPSS defaults to 0.5 and blast-radius to
+ * 1.0 — the same conservative defaults the Sentinel uses when unknown. This is
+ * disclosed on the snapshot (`enrichment: 'run-derived'`) so the UI never
+ * implies live threat-intel it doesn't have.
+ */
+import { listRuns, readRun } from './runs-reader.js';
+import { normalizeFinding } from './finding-normalize.js';
+import { buildAttackPaths, computePostureScore, rankFindings } from '../core/security-audit/index.js';
+import { COMPOSED_ENGINE_AGENTS } from '../core/security-audit/types.js';
+/** The engine "security" squad agent ids whose findings the Sentinel composes. */
+const SECURITY_AGENT_IDS = new Set(Object.values(COMPOSED_ENGINE_AGENTS));
+/** How many ranked findings the dashboard shows (highest-priority first). */
+const TOP_RANKED_LIMIT = 20;
+/** Empty snapshot returned when there is no run to derive a posture from. */
+function emptySnapshot() {
+    return {
+        sourceRunId: null,
+        scannedAt: null,
+        postureScore: null,
+        attackPaths: [],
+        rankedFindings: [],
+        findingCount: 0,
+        securityAgentCount: 0,
+        enrichment: 'run-derived',
+    };
+}
+/**
+ * Build the security-posture snapshot from the newest recorded run under
+ * `runsDir`. Returns an empty (null-scored) snapshot when no run exists or the
+ * newest run's detail is unreadable. A run that IS present but has zero
+ * security-squad findings is scored as a clean 100/A with a non-null
+ * `sourceRunId` (not an empty snapshot). Never throws — a misshaped run artifact
+ * degrades to an empty/clean posture so the caller renders a state, not a 500.
+ *
+ * @param nowMs - injectable clock for deterministic tests; defaults to Date.now().
+ */
+export function buildSecurityPostureSnapshot(runsDir, nowMs = Date.now()) {
+    const runs = listRuns(runsDir);
+    if (runs.length === 0)
+        return emptySnapshot();
+    // listRuns is newest-first; derive posture from the most recent run.
+    const latest = runs[0];
+    if (!latest)
+        return emptySnapshot();
+    const detail = readRun(runsDir, latest.runId);
+    if (!detail)
+        return emptySnapshot();
+    const securityAgents = detail.agents.filter((a) => SECURITY_AGENT_IDS.has(a.agentId));
+    // Normalise every persisted finding (drop non-objects, coerce id/module/description/severity)
+    // so a misshaped run artifact degrades to an empty-but-valid posture rather than
+    // throwing a 500 out of the Sentinel's pure functions (never-throw contract).
+    const findings = securityAgents.flatMap((a) => (Array.isArray(a.findings) ? a.findings : [])
+        .map(normalizeFinding)
+        .filter((f) => f !== null));
+    // The Sentinel's pure scoring pipeline over the composed findings. No live
+    // CVE index at read-time (empty map → EPSS defaults to 0.5); blast-radius
+    // weight 1.0 since data sensitivity is not known outside an active scan.
+    const attackPaths = buildAttackPaths(findings);
+    const postureScore = computePostureScore(findings, attackPaths, nowMs);
+    const emptyCveIndex = new Map();
+    const rankedAll = rankFindings(findings, emptyCveIndex, 1);
+    const rankedFindings = rankedAll.slice(0, TOP_RANKED_LIMIT);
+    return {
+        sourceRunId: latest.runId,
+        scannedAt: detail.summary.completedAt || null,
+        postureScore,
+        attackPaths,
+        rankedFindings,
+        findingCount: findings.length,
+        securityAgentCount: securityAgents.length,
+        enrichment: 'run-derived',
+    };
+}
+//# sourceMappingURL=sentinel-reader.js.map

package/dist/bridge/sentinel-reader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sentinel-reader.js","sourceRoot":"","sources":["../../bridge/sentinel-reader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAE7F,OAAO,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAGtE,kFAAkF;AAClF,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,CAAC;AAE/F,6EAA6E;AAC7E,MAAM,gBAAgB,GAAG,EAAE,CAAC;AA0B5B,6EAA6E;AAC7E,SAAS,aAAa;IACpB,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,SAAS,EAAE,IAAI;QACf,YAAY,EAAE,IAAI;QAClB,WAAW,EAAE,EAAE;QACf,cAAc,EAAE,EAAE;QAClB,YAAY,EAAE,CAAC;QACf,kBAAkB,EAAE,CAAC;QACrB,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,4BAA4B,CAC1C,OAAe,EACf,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,aAAa,EAAE,CAAC;IAE9C,qEAAqE;IACrE,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM;QAAE,OAAO,aAAa,EAAE,CAAC;IAEpC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACtF,8FAA8F;IAC9F,iFAAiF;IACjF,8EAA8E;IAC9E,MAAM,QAAQ,GAAc,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CACvD,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C,GAAG,CAAC,gBAAgB,CAAC;SACrB,MAAM,CAAC,CAAC,CAAC,EAAgB,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAC3C,CAAC;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,WAAW,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC/C,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,aAAa,GAAkC,IAAI,GAAG,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,cAAc,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAE5D,OAAO;QACL,WAAW,EAAE,MAAM,CAAC,KAAK;QACzB,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI;QAC7C,YAAY;QACZ,WAAW;QACX,cAAc;QACd,YAAY,EAAE,QAAQ,CAAC,MAAM;QAC7B,kBAAkB,EAAE,cAAc,CAAC,MAAM;QACzC,UAAU,EAAE,aAAa;KAC1B,CAAC;AACJ,CAAC"}

package/dist/bridge/server.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Bridge HTTP Server
+ *
+ * Exposes the BridgeRouter over HTTP using Node's built-in http module.
+ * No external dependencies required — keeps TestTeam dependency-light.
+ *
+ * Endpoints:
+ *   GET  /health     — liveness check
+ *   GET  /agents     — full agent capability list with executor types
+ *   GET  /runs       — summaries of past runs read from the .run/ directory
+ *   GET  /runs/:id   — full detail (summary + agent results) for one run
+ *   POST /execute    — execute a BridgeTask and return BridgeResult
+ */
+import { type Server } from 'node:http';
+import { BridgeRouter } from './router.js';
+import { ShellExecutor } from './shell-executor.js';
+import { type RateLimitOptions } from './rate-limiter.js';
+import type { RunStreamDriver } from './run-stream.js';
+import type { AgentResult } from '../core/types.js';
+import { type LLMProvider } from '../core/feature-bdd/llm-provider.js';
+export interface BridgeServerOptions {
+    port?: number;
+    /** Inject custom router (useful for testing). */
+    router?: BridgeRouter;
+    /** Directory holding run artifacts (defaults to <cwd>/.run). */
+    runsDir?: string;
+    /**
+     * Driver that executes a pipeline phase and pushes events through a
+     * RunEventEmitter. When omitted GET /runs/stream returns 503.
+     */
+    runStreamDriver?: RunStreamDriver;
+    /**
+     * Runs ONE agent end-to-end via its real run() (not the /execute executor
+     * primitive) and returns the AgentResult. When omitted POST /agents/:id/run
+     * returns 503. Injected at startup from the loaded config (see CLI --serve).
+     */
+    agentRunner?: (agentId: number) => Promise<AgentResult>;
+    /** Directory holding Feature Canvas graphs (defaults to <cwd>/.testteam/canvases). */
+    canvasDir?: string;
+    /**
+     * Allowed CORS origins. Defaults to TESTTEAM_BRIDGE_ORIGINS env var (comma-separated),
+     * or ['http://localhost:5173'] if unset.
+     */
+    allowedOrigins?: string[];
+    /**
+     * Token required on mutating requests via x-bridge-token header.
+     * Defaults to TESTTEAM_BRIDGE_TOKEN env var. Empty string = no auth (unauthenticated).
+     */
+    authToken?: string;
+    /**
+     * Rate limiting for mutating (non-GET) requests, keyed by client IP. OFF by default;
+     * enable via `{ enabled: true }` or the TESTTEAM_BRIDGE_RATE_LIMIT env var. Conservative
+     * default when on: 60 requests / 60 s per IP → 429 with Retry-After on exceed.
+     */
+    rateLimit?: RateLimitOptions;
+    /**
+     * LLM provider for BDD + test generation. When omitted a lazy AnthropicProvider is
+     * constructed at server startup (reads the API key only at generate-time, so constructing
+     * without a key is safe). Pass a MockLLMProvider in tests.
+     */
+    llmProvider?: LLMProvider;
+    /**
+     * Root directory for feature BDD artifacts (defaults to <cwd>/.testteam/features).
+     * Separate from canvasDir so canvas graphs and BDD artifacts don't collide.
+     */
+    featuresDir?: string;
+    /**
+     * ShellExecutor used to run scoped feature tests (GET /bdd/run). Defaults to a
+     * new ShellExecutor; inject a stub in tests so BDD runs don't spawn real vitest.
+     */
+    shellExecutor?: ShellExecutor;
+}
+/**
+ * Create and return the HTTP server without starting it.
+ * Useful for testing — call `server.listen(port)` yourself.
+ */
+export declare function createBridgeServer(options?: BridgeServerOptions): Server;
+/**
+ * Start the Bridge HTTP server on the given port.
+ * Returns the server instance for graceful shutdown.
+ */
+export declare function startBridgeServer(port?: number, options?: Omit<BridgeServerOptions, 'port'>): Server;
+//# sourceMappingURL=server.d.ts.map

package/dist/bridge/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../bridge/server.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAA2D,KAAK,MAAM,EAAE,MAAM,WAAW,CAAC;AAGjG,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAYjD,OAAO,EAAe,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAQpE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAejD,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,kCAAkC,CAAC;AA+J1C,MAAM,WAAW,mBAAmB;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iDAAiD;IACjD,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,gEAAgE;IAChE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC,CAAC;IACxD,sFAAsF;IACtF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;;OAIG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAwDD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,GAAE,mBAAwB,GAAG,MAAM,CA43B5E;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,SAAO,EACX,OAAO,GAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAM,GAC9C,MAAM,CAWR"}